CVE-2024-12633: JoomSport WordPress Plugin XSS Vulnerability

CVE-2024-12633 Overview

CVE-2024-12633 is a Reflected Cross-Site Scripting (XSS) vulnerability in the JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress. The flaw affects all versions up to and including 5.6.17 and stems from insufficient input sanitization and output escaping on the page parameter [CWE-79]. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. The vulnerability was published to the National Vulnerability Database (NVD) on January 7, 2025.

Critical Impact
Unauthenticated attackers can execute arbitrary scripts in a victim's browser session, enabling session theft, credential harvesting, and site defacement when a target interacts with a malicious link.

Affected Products

JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress
All plugin versions up to and including 5.6.17
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-01-07 - CVE-2024-12633 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12633

Vulnerability Analysis

The JoomSport plugin fails to sanitize the page request parameter before reflecting it back into rendered HTML output. An attacker crafts a URL containing malicious JavaScript in the page parameter and delivers it to a target through phishing, social media, or embedded links. When the victim clicks the link, the server reflects the payload into the response, and the browser executes it in the context of the vulnerable WordPress site. The scope change reflected in the CVSS vector indicates that injected script can affect resources beyond the vulnerable component, including other origins in the browsing session.

Root Cause

The root cause is missing input validation and missing output escaping on the page parameter. The plugin accepts user-controlled input from the query string and writes it directly into HTML without applying WordPress sanitization functions such as esc_html(), esc_attr(), or sanitize_text_field(). This is a classic instance of CWE-79 (Improper Neutralization of Input During Web Page Generation).

Attack Vector

Exploitation is network-based and requires user interaction. An attacker constructs a URL pointing to the vulnerable WordPress site with a JavaScript payload embedded in the page parameter. The attacker delivers the URL through email, chat, or a third-party website. When an authenticated administrator or logged-in user clicks the link, the injected script runs with the user's privileges, allowing session cookie theft, forced administrative actions via CSRF chains, or redirection to attacker-controlled infrastructure.

The vulnerability manifests when the page GET parameter is reflected into plugin-rendered pages without escaping. See the WordPress Plugin Changeset and the Wordfence Vulnerability Report for the code-level fix details.

Detection Methods for CVE-2024-12633

Indicators of Compromise

HTTP requests to the WordPress site containing suspicious content in the page query parameter, such as <script>, javascript:, onerror=, or URL-encoded equivalents like %3Cscript%3E.
Referrer headers pointing to unfamiliar external domains preceding requests to plugin endpoints.
Unexpected outbound requests from user browsers to attacker-controlled domains after visiting affected pages.

Detection Strategies

Inspect web server access logs for GET requests to JoomSport plugin URLs containing script tags or JavaScript event handlers in the page parameter.
Deploy Web Application Firewall (WAF) rules that flag reflected XSS patterns targeting WordPress plugin endpoints.
Correlate HTTP request logs with browser-reported Content Security Policy (CSP) violations to identify exploitation attempts.

Monitoring Recommendations

Monitor the WordPress plugin directory for the installed version of joomsport-sports-league-results-management and alert when it is at or below 5.6.17.
Track administrator session activity for anomalies such as unexpected profile changes, new user creation, or plugin installations that may indicate a successful XSS-driven takeover.
Enable audit logging for WordPress admin actions and forward logs to a centralized SIEM for correlation.

How to Mitigate CVE-2024-12633

Immediate Actions Required

Update the JoomSport plugin to a version later than 5.6.17 where the page parameter is properly sanitized.
If an update is not immediately available, disable the JoomSport plugin until it can be patched.
Review WordPress administrator accounts for unauthorized changes and rotate credentials for any account that may have clicked a suspicious link.

Patch Information

The vendor addressed the vulnerability in the code committed under WordPress Plugin Changeset 3209054. Site administrators should install the fixed version through the WordPress plugin update mechanism. Additional technical details are available in the Wordfence Vulnerability Report.

Workarounds

Deploy a WAF rule to block requests where the page parameter contains HTML tags, JavaScript keywords, or common XSS payload signatures.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
Restrict access to WordPress admin pages by IP allowlist to reduce the risk of a privileged user triggering the payload.

bash

# Example nginx rule to block script tags in the page parameter
if ($arg_page ~* "(<script|javascript:|onerror=|onload=|%3Cscript)") {
    return 403;
}